rfc822.c in Mutt through 2.0.4 allows remote attackers to cause a denial of service…
Priority LOW 34CWE-401Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Partial Red Hat: 1 fixed, 2 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-401.
Summary
rfc822.c in Mutt through 2.0.4 allows remote attackers to cause a denial of service (mailbox unavailability) by sending email messages with sequences of semicolon characters in RFC822 address fields (aka terminators of empty groups). A small email message from the attacker can cause large memory consumption, and the victim may then be unable to see email messages from other persons.
Why it matters now
EPSS 0.0283 86th percentileScored 2026-11-08
Fix Partial Red Hat: 1 advisoryRed Hat: 1 fixed, 2 without a fix
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 5
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:mutt:mutt:*:*:*:*:*:*:*:* | up to 2.0.4 | Vulnerable | mutt |
| cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* | 9.0 | Vulnerable | Debian |
| cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* | 10.0 | Vulnerable | Debian |
| cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:* | 32 | Vulnerable | Fedoraproject |
| cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:* | 33 | Vulnerable | Fedoraproject |
- cpe:2.3:a:mutt:mutt:*:*:*:*:*:*:*:* Versions up to 2.0.4 Vulnerable ·mutt
- cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Debian
- cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* Versions 10.0 Vulnerable ·Debian
- cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:* Versions 32 Vulnerable ·Fedoraproject
- cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:* Versions 33 Vulnerable ·Fedoraproject
Remediation
Red Hat 1 advisory
- RHSA-2021:4181 Released 2021-11-09 · Red Hat rating Moderatemutt security, bug fix, and enhancement update
- Red Hat Enterprise Linux AppStream (v. 8) mutt-5:2.0.7-1.el8
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux 6 | Affected | No fix planned: Out of support scope |
| Red Hat Enterprise Linux 7 | Affected | No fix planned: Out of support scope |
| Red Hat Enterprise Linux AppStream (v. 8) | Fixed | RHSA-2021:4181 |
Not affected: 1 product
- Red Hat Enterprise Linux 9
Timeline
- 2026-10-02 Threatist record created from CVE-2021-3181
- 2026-10-03 Alias added: GHSA-prp6-7gc9-4jmw
References
Patch 3
Advisory 8
- https://gitlab.com/muttmua/mutt/-/issues/323
- [oss-security] 20210119 Re: mutt recipient parsing memory leak
- [debian-lts-announce] 20210120 [SECURITY] [DLA 2529-1] mutt security update
- GLSA-202101-25
- DSA-4838
- [oss-security] 20210127 glibc iconv crash with ISO-2022-JP-3
- FEDORA-2021-a4f016c6c8
- FEDORA-2021-4205e1fc23
Sources
- CVE-2021-3181 · CVE Program
- CVE-2021-3181 · NVD
- FIRST EPSS
- GHSA-prp6-7gc9-4jmw · GitHub Advisory Database · CC BY 4.0
- CVE-2021-3181 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences